start	end	text
0	7200	Good morning, DEF CON biohacking village. It's an honor to be here. If you're confused where you
7200	13740	are, you're somewhere in cyberspace at your home. Following the DEF CON tradition, you may be
13740	20540	somewhere between sober and completely intoxicated. We recommend aggressive rehydration and, you know,
20540	25140	take a shower. That'll really help out. But before you do so, we appreciate you coming to our talk
25140	31760	here. The talk is entitled Lessons Learned from a Pale Horse. What COVID-19 can teach us about
31760	37600	healthcare cybersecurity. How are you, buddy? We haven't seen each other in person for a while.
38020	41600	I feel like I haven't seen anybody in person for a long time.
41600	46920	Was it November when we last saw each other, which for us is like a decade?
47220	52880	Yeah, too long. I feel like I'm really missing my hacker family. I've just been talking with
52880	59280	my wife about how much I miss going to DEF CON, seeing people in person, walking around. And then
59280	64420	also, it's kind of depressing to think about it, but it's also a kind of a cool opportunity. Here
64420	69580	we are at the Biohacking Village, but invited to speak here on a cool topic like this. And people
69580	73440	all around the globe are going to be able to watch this. So I think we should go ahead and kick it
73440	78000	off. What do you think, Jeff? I totally agree. But first, I think it's just so important to shout out
78000	83740	what an amazing accomplishment and achievement it is that villages like the Biohacking Village
83740	90560	and others, and even DEF CON itself, have been pulled into this safe mode virtual experience.
90560	95960	As people who have done events ourselves, I can't even imagine the amount of work it took to do this,
95960	100260	knowing that our friends at the Biohacking Village, and I'm sure others, have been working
100860	105780	since last DEF CON on doing an amazing physical event, and then all of a sudden having to
105780	110360	reverse course and change that. So I just want to give them a huge shout out and major props
110360	118500	for what is a job very well done. But yeah, golf clubs, sure, absolutely, and more and more.
119760	125560	Let's kind of get into it, man. I think when we originally came up with this, so first of all,
125560	131060	I guess for those of us who we haven't had the pleasure of meeting, my name is Replicant Jeff.
131860	136320	I am an anesthesiologist and security researcher hacker.
137400	143020	My name is Christian Nemeth. People call me Kawati. That's my handle. I'm an emergency
143020	148390	medicine physician and assistant professor over at UC San Diego.
149400	154140	So I mean, we've both had the privilege of taking care of patients during this
155300	161040	global pandemic. We have, you know, been in the critical care units and the emergency room,
161540	166140	treating patients with COVID-19. And it's been kind of a surreal experience for us because
166660	172260	before all of this, we were and still obviously are, you know, advocates for security and health
172260	178640	care, being security researchers and kind of having this thesis statement that healthcare security is
178640	184340	more than just privacy and patient records and things like that. There are, you know, vulnerabilities
184340	188840	and we've gone over this extensively at other DEF CONs and other gatherings where we're able to
188840	193780	talk about these things, you know, medical devices and healthcare infrastructure are as vulnerable
193780	199880	as any other area of connected life. And we know that those vulnerabilities have the potential to
199880	205980	potentially affect patients, both in how we care for them and their long term outcomes. So we've
205980	212220	kind of been pushing this thesis for a while. And then all of a sudden, we found ourselves kind of
212220	216940	on the front lines, knee deep in COVID patients during this pandemic. And that's kind of changed,
216940	222140	I think, a little bit of our perspective about ways in which we as a healthcare system can prepare
222140	228060	for not just events like this, but also security related concerns as well. So I think what we
228060	233780	wanted to do is kind of see were there any insights that we obtained from our clinical
233780	237780	practice and kind of how we think about disaster medicine, which we'll get into and
239680	247180	utilization of resources and readiness and preparedness in a medical type of emergency.
247180	252940	Can we apply some of those thoughts and lessons to the security realm? Sound like a plan?
253120	257140	Sounds like a plan. We're gonna go ahead and get kicked off. Many of you out there are like,
257140	262560	what is disaster medicine? It doesn't even make any sense. Like I'm familiar with cardiology,
262560	267180	like they take care of the heart. I'm familiar with gastroenterology. You know, they give me
267300	273640	a Valium, have me show up next morning and then scope my intestines. Well, many of you out there
273640	279140	might be wondering, what is disaster medicine? And so under medicine, generally a medicine,
279140	283660	you know, surgery, the practice of taking care of someone's health and treating disease,
283660	290220	there are all sorts of disciplines. I practice emergency medicine. Jeff practices pediatrics
290220	298220	and anesthesia. And there's so much to know in modern medicine, new treatments, new diseases that
298220	303500	we, or sorry, diseases that we learn more about. And as a consequence, it's impossible for a doctor
303500	308860	to know all of it. And it would actually probably be very unsafe for a doctor to practice, you know,
308860	314760	every form of medicine. So we specialize. Under the house of medicine with all these different
314760	322440	specialties, there's a subspecialty, a niche, a further niche, if you will, that discusses and
322440	329140	studies and practices disaster medicine. Disaster medicine is how do you take care of people,
329140	336320	not when you're in a fancy hospital where you have two MRI machines, an entire trauma team,
336320	340900	you know, dozens and dozens of doctors on a particular service, and hundreds of nurses.
340900	348580	Instead, how do you take care of thousands of patients during an earthquake or during a
348580	353660	hurricane? How do you take care of patients as they're swelling through the front doors of your
353660	358680	hospital during a pandemic? And you can see that there's some clear disaster medicine being
358680	364280	practiced today all over the globe in response to the global pandemic. And this is a picture
364400	370160	of a disaster in the United States and a particular specialized team that the government
370160	377220	can call upon to remotely, sorry, to go to a particular location and practice disaster medicine.
377220	381540	These are called DMAT teams or disaster medicine assistance teams. These are comprised of
381540	386940	multidisciplinary teams, nurses, technicians, doctors, they'll go to a place in response to
387080	391600	a disaster, they'll organize how they take care of all those patients, they'll deploy electronic
391600	397100	health systems, and then they'll be able to help treat all of those people, perhaps in a high
397100	402300	school gym, for instance, instead of a hospital. So these are called DMAT teams, they practice
402300	407880	disaster medicine, and they study it. You know, lessons learned from Hurricane Maria, for example,
407880	412380	well, we study that, do academic papers and publish them so that the next disaster that
412380	419760	rolls around, we're better prepared to respond to that. Well, Jeff and I are thoroughly convinced
419760	425100	that there should be a subsection of disaster medicine called cyber disaster medicine.
425100	433320	And we picked a picture of the DEFCON CTF for a couple different reasons. One, because a lot of
433320	439260	what cyber disaster medicine is going to be is merging the two disciplines of clinical practice,
439260	446100	taking care of patients' health, treating disease, while also addressing technological problems,
446100	451880	systems of connected medical technology that are malfunctioning or perhaps being attacked.
451880	456220	That's really our premise of what Jeff had mentioned. Our argument, our thesis is that
456220	461660	if you attack a hospital, because it's so connected, and so interdependent on vulnerable
461660	469180	technology, if you attack that, it won't be available for patient care, or the integrity
469180	474540	of the data flowing from these systems will be changed and unreliable, and as a consequence,
474540	479920	patients' health will be affected. So we think there needs to be essentially a cyber DMAT team,
479920	486420	so where we take doctors and hackers and nurses, put them in a team, and if some hospital in
486420	493220	Nebraska or some hospital in Idaho gets hit by a ransomware attack, for example, and they are
493220	500100	unable to take care of patients, they're going to need both the medical expertise, the person power
500100	504940	to respond to taking care of the strokes and heart attacks that are happening, while also
504940	511380	simultaneously working with the technical teams to mitigate the issue and fix those
511380	518060	damages to the technological infrastructure to restore care. So we think convincingly,
518060	521700	though, it's going to be more and more of a need of these hybrid teams, where we have both hackers
521700	527660	and doctors responding to attacks on healthcare infrastructure. We call that cyber disaster
527660	533620	medicine. And Claudia, just two points that I want to make real quick about the concept of
533620	538140	disaster medicine in general is that it assumes that you're going to be operating from a standpoint
538140	547460	of very limited and constrained resources. And it also implies in some sense that the outcomes you
547460	552520	are able to achieve are going to be less than the ideal outcomes that you would have in a
552520	558120	non-disaster situation, and that there is some sense of needing to triage priorities accordingly.
559120	564700	Absolutely. And one of the kind of foundational tenets of disaster medicine is the concept you
564700	572860	mentioned of triage. If you have 10 patients in front of you, one is dead or just nearly died,
572860	580420	three are dying, and three are okay, and some are in between, you need a system to be able to respond
581120	586860	in the right order to take care of the patients that you can best help with. So, you know,
586860	592460	controversial part of this is, you know, don't treat the patients that are about to die. Those
592460	600100	patients need advanced airways. They need, you know, five, six people to major surgery. Yeah,
600100	603960	they might need major surgery. They might need, you know, a lot of broad spectrum antibiotics.
603960	609300	They need a lot of things that you might not have. If you spend your time focusing on the people who
609300	614660	are dying, doing CPR, those types of things, then those three people that might benefit from your
614660	619660	care that don't need that many resources but still could have an adverse outcome if you don't
619660	624280	pay attention to them immediately, those are affected. So, it's this concept of can you make
624440	632760	a system, can you make a philosophy, if you will, a protocol to be able to respond and make decisions
632760	638340	on who you treat with the limited resources you have and in what order. So, I think these are
638340	641540	foundational things. I mean, if you don't have a choice, you don't have a choice. If you're
641540	647020	responding after an earthquake, you can't treat everyone at the same time equally. You have to
647020	653040	pick and choose. I think in some sense, the idea of triage in a healthcare delivery organization
653040	658020	from a security standpoint has been one of the trickier things in normal times, right? Because
658020	662620	we almost have like a paralysis of indecision. People like us talk about all the ways in which
662620	667260	we could improve foundational and infrastructure security of a healthcare delivery organization.
667260	671100	We talk about medical devices and things like that. And sometimes it can seem like there are
671100	675240	too many things to fix, whereas this triage mentality helps us kind of focus our priorities
675900	679960	and really kind of hone in on the things that may be actionable with the biggest yield and
679960	687440	impact for resources invested. Yeah, I completely agree. We love security. You know, we drink the
687440	694200	Kool-Aid. We are admittedly believe it is a big risk to patient safety. But this is just one of
694200	701820	dozens of issues, really serious issues facing healthcare across the globe. Security is just
701820	706500	one of them. For instance, you know, the disproportionate allocation of resources
706500	711540	for disadvantaged populations, right? Like population health is a big deal, social determinants
711540	716280	of health. Security is just one of these things. And I agree, there's this triage element of it.
716280	721280	COVID's blown all that up, right? So we have a global pandemic. It is sucking every single
721280	727740	resource it possibly can out of the healthcare system. And things like security, undoubtedly,
727740	733460	in the triage, if you will, are going lower. I understand that. That's very important. You have
733460	739440	to take care of those patients. But what I fear is that we are putting far more attention to
740000	744100	treating the immediate issues of COVID, not realizing that we are really opening ourselves
744100	750040	up to the vulnerabilities, and we're not fixing them. And as a consequence, we could have a
750040	756520	one-two punch. We could have COVID and then a ransomware attack on top of it. Our ability to
756520	762160	take care of patients in some of the hospitals across this country is already so hard. If we
762160	767000	had to deal with a ransomware attack on top of it, my ability to take care of COVID patients
767000	771760	in the emergency department is going to be hindered. That's going to hurt my patients. And so I think
771760	777260	foundational security issues are still something to pay attention to during this pandemic.
777910	784540	I mean, that's another tenet of disaster medicine, right? You need to fortify your infrastructure
784540	790820	during a particular crisis with the anticipation that subsequent issues or events could
791330	800500	even further hamper your ability to get the best outcomes in your emergency situation.
800500	806940	So let's move on to some of the points that we came up with just in conversation earlier
806940	813120	about some of the things that we as clinicians on the ICU core in the emergency room have
813120	818780	drawn as parallels to some of the issues that we as security researchers wearing a different hat
819480	825400	were worried about and kind of thinking about pre-COVID and see if there are some areas where
825400	831320	we can draw parallels and maybe even lessons from that. So I want to talk a little bit about
831320	837580	kind of just basic data gathering, right? So this idea of having the information you need
837580	841260	in order to make actionable decisions. From the same point of the pandemic,
841260	848360	I remember I was out of the country back in February on a medical surgical mission trip,
848360	854880	and we at that point just started receiving information. I'm in Sacramento. I work at UC Davis
855500	861060	Medical Center, and we were actually the first hospital in the country to care for a patient
861980	867200	who was diagnosed with coronavirus, and they weren't able to identify the source of spread,
867200	875240	so the first example of what we call the community-acquired case. And that kind of set
875240	881740	off this initial first couple of weeks to early months of uncertainty where we really didn't have
881840	886700	a good idea about what the epidemiology looked like, right? We knew that there were reports
886700	891480	earlier in December about where it had originated from a global standpoint. We
891480	895840	knew that we were starting to see cases in other parts of the world, particularly Europe,
895840	901920	but we really didn't have a sense of what the overall disease burden was in the U.S. and our
901920	906740	communities, and we thought that we were still at an earlier enough phase that we could do
906740	914100	individual kind of contract tracing and isolation, kind of this containment model as opposed to the
914100	921280	mitigation that we're now in. So I think there were a lot of factors that played into that,
921280	925820	obviously, and we don't need to necessarily get into that as much. Some of the issues with
925820	931620	cross-cultural communications between countries, some of the mechanisms that we had in place from
931740	937220	a federal standpoint that were either kind of like mothballed or not rolled out quite as
937220	945000	effectively, but really had a surveillance issue in the beginning period of this crisis. And so
945520	951100	do you feel like in healthcare there's a similar almost like fog of war when it comes to security,
951100	955040	when it comes to understanding the threats faced by individual organizations, and kind of how
955040	960040	robust are we with respect to being able to communicate and share intelligence from that
960040	966440	standpoint? I think in some regards we've made like huge strides, right? So things like organizations
966440	974440	such as the Help ISAC allow partners to pretty quickly communicate some security issues. So
974440	978880	for those of you listening or watching this video, if you're a part of that, you know,
978880	983300	you're going to get multiple emails a day from some of these threat intelligence sharing
983300	989160	organizations saying, oh, this is going on, pay attention to this. And sometimes the conversations
989160	992980	even get to the point of, well, I built some tools, or these were particular rules I wrote,
992980	999340	this is how I'm mitigating this particular attack. Those types of things do happen.
999420	1005700	But generally speaking, we are not, when I say we, healthcare security is not anywhere
1005700	1010900	close to where it should be. Just because these organizations exist don't mean that
1010900	1016380	many hospitals are taking advantage of them. Because of one of the primary things that we
1016380	1022460	want to bring just back to everyone's mind is that there are not a lot of people that
1022460	1027240	work, not a lot of security people that work for healthcare. I mean, there's a dearth of
1027240	1032160	people and resources around insecurity around healthcare. So even if you do have robust
1032160	1037940	communication channels, which I don't think we have, but let's say we do, you need people to
1037940	1044160	receive that information, digest it, and act upon it. And so at the heart of this issue of COVID,
1044160	1050020	we had very poor surveillance at the beginning. I think we have had a chronic issue, a chronic
1050880	1056440	lack of appropriate surveillance of healthcare security. There are a couple of barriers,
1056440	1062620	I think, to that. There's HIPAA. Now I'm going to go ahead and say, of course, I think I can speak
1062620	1067100	for Jeff. We're big supporters of HIPAA. We think the protection of patient information is really,
1067100	1072920	really important. We are hackers, so we care about our data and it being secure. We care about our
1074120	1079980	But HIPAA, or if those of you who aren't up there, that piece of legislation that essentially
1081020	1085980	penalizes people who breach protected health information, leak it, lose it, etc.
1087020	1092760	It's been used as an example of why you can't share information. I can't talk about a breach
1092760	1096600	when we lost a laptop, or I can't talk about a particular vulnerability, a piece of malware that
1096600	1104220	hit because it might be a HIPAA concern. And we need to make sure HIPAA comes first, as opposed to
1104220	1108800	information sharing and protecting the hospital down the street from getting hit with the exact
1108800	1114420	same thing that I did. That should be the priority and it's not. There's liability concerns. So
1114420	1120260	there's the thought of, if there is a breach of a hospital or a hospital is under attack,
1120260	1125260	what will the hospital be liable for? If, for instance, the vulnerability that was exploited
1125260	1132480	had a patch six months ago, and because health care entities deal a lot with other types of
1132480	1138880	legal issues and security is not typically one of them, their legal teams tend to shy away from
1138880	1147600	disclosing information, sharing information in a timely manner. There are always branding concerns.
1147600	1155240	So people don't want to go get care at hospitals that have had breaches. Why? Because there are
1155240	1159320	afraid their information is going to get breached or they're afraid while they're there that they're
1159320	1163540	going to get hacked and something bad will happen to them. So health care institutions generally are
1163540	1171140	adverse to sharing information because of branding concerns and market share competitions,
1171140	1176220	which is some fierce, fierce competition in health care. I was going to say there's also an
1176220	1181760	incredibly complex hierarchy, right? Even within a single health care delivery organization with
1181760	1189300	respect to the number of people that are involved in some of those branding issues that you talked
1189300	1193940	about, some of the legal and liability issues. And it's very hard to centralize and coordinate
1193940	1199060	decisions with respect to security sometimes because they affect so many different aspects of
1199340	1205200	a hospital's function. And we kind of saw something similar in the overall, I would say, government
1205200	1214080	response to this current crisis is that you just have a lot of different levels of leadership,
1214080	1219440	levels of decision-making, levels of stakeholders from a federal, state, and local level. And
1219440	1224240	sometimes those wires can get crossed and sometimes there isn't the best communication
1224240	1229000	with the degree to which their spheres of responsibilities overlap. So sometimes I think
1229000	1233680	we make mutual assumptions that somebody else is covering a certain problem, whether it's things
1233680	1239400	like PPE or bed capacity or things like that. We sometimes say, well, don't worry
1239400	1243400	about the number of ICU beds we have because the federal government will send this hospital ship or
1243400	1247720	we're expecting a shipment of PPE from the state. And sometimes I think that
1248880	1254160	degree of organizational complexity makes it really, really difficult to make quick, streamlined
1254160	1258280	decisions. And sometimes that can also affect the composition of the teams that you're working with,
1258280	1263120	right? So if you have a system that is not quite as efficient or as effective, you can get pretty
1263120	1267440	high turnover. I think we've seen that before in hospital security teams, right? There's this
1267980	1271620	additional level of complexity that comes with working within healthcare that people
1271620	1274900	from the outside aren't always accustomed to. And sometimes that can be very frustrating
1274900	1278680	to the security professional working in healthcare for the first time. And I think
1278680	1283700	we've both seen instances of pretty significant burnout and turnover in that sense, simply from
1283700	1287680	the complexity of the overall organizational structure.
1288640	1293620	Completely agree. You know, hackers want to make things better for the most part. You know,
1293620	1299500	we could talk about malicious adversaries, etc. But that aside, hackers, security folks,
1299500	1303240	they're trying to make things better. They're trying to make things more secure.
1303240	1307960	And when they go work for a healthcare organization, that's a great opportunity to do some,
1307960	1313980	to take your knowledge and your skills and put it towards helping people. You might not be at
1313980	1318420	bedside pushing a medication and an IV, but if you're supporting the hospital's infrastructure
1318420	1323660	that made that medication administration possible and safe and secure, you're really,
1323660	1328400	really doing something good. Just like you mentioned, we've heard horror story after
1328400	1336620	horror story about talented security professionals, talented hackers going and working at hospitals,
1336620	1342260	taking a pay cut, and then finding concerning things, bringing them to the attention of their
1342260	1348680	leadership, and at the end of the day saying, we can't fix that issue because of, insert some
1349540	1356180	reason, the cardiologist said no, they want to use that vulnerable device because it's their
1356180	1362960	favorite, or we don't have the budget to do that, we need to buy a new MRI machine, etc., etc. So it
1362960	1369500	can be demoralizing to work for a healthcare organization in a security capacity and feel
1369500	1374960	like you can't really change things. And a lot of that has to do with the bureaucratic complexities,
1374960	1380040	you know, COVID, there are so many different agencies and state governments, etc., it's just
1380040	1387040	turned into this bureaucratic nightmare. Even in the best of times, a hospital is still a
1387040	1393340	bureaucratic nightmare with so many different layers of administration and clinical expertise
1393340	1398840	that at the end of the day, the bureaucracy can cause rapid turnover of our security
1398840	1406180	professionals. And, you know, we need them there. The 2017 Health and Human Services Task Force
1406180	1412900	report, commissioned by Congress, came back and said they thought a minority of hospitals in the
1412900	1419160	United States have even a single full-time security professional on staff, you know, but yet
1419160	1424540	we still march forward connecting more systems together, increasing our attack
1424540	1431240	surfaces, etc., without the commensurate investment in security personnel. As a consequence of that,
1431240	1435680	we're putting ourselves in an even worse situation where we are more vulnerable, we have less people
1435680	1441180	to respond to, and the bureaucracy is getting even more complex. It's an impossible proposition
1441180	1443860	to face. That problem of turnover,
1446640	1451120	it really highlights how important institutional memory is, right? And I think that was something
1451120	1455180	that we saw from the standpoint of pandemic response, too, is that there were structures
1455180	1459220	in place, there were playbooks in place. Some of the problems that we've run into could have
1459220	1463540	potentially been solvable. And I think we've both seen examples of clinical situations
1464320	1469600	with respect to security where, you know, people have worked on a problem, they've even come up
1469600	1473480	with a potential solution to a problem, they've even started to implement that solution. And then
1473480	1479100	they go, whether it's for, you know, other opportunities, or just the disillusionment
1479100	1483800	that we've already talked about, they leave. And the next person coming in sometimes doesn't have
1483800	1487120	the ability to pick up where they left off, they have to kind of reinvent the wheel from the very
1487120	1493520	beginning. And that chance to build the institutional memory is kind of lost.
1495060	1499440	Absolutely. And that's a problem in a lot of different industries, but it's particularly
1499440	1505580	important in healthcare, because there are so much, there's so much specialized, weird medical
1505580	1510860	devices. It feels like if you work at a hospital, you know, I don't work for IT at a hospital or
1510860	1515700	security at a hospital, you don't only have to know the technical infrastructure and routers
1515700	1520400	and firewalls like you do at any other organization, you also have to know all this weird,
1520400	1528080	this device on the fourth floor is a 10 year old infusion pump. And it acts very strange. And
1528080	1531700	we have tried our best to mitigate its vulnerabilities in the following way.
1531900	1536540	And it does this function. And when it doesn't do this function, this is the health implication,
1536540	1541240	there's so much more context around the technological infrastructure in a hospital
1541240	1546340	that is outside the regular domain of security. And so if you don't have institutional memory,
1546340	1553240	you can't pass down that knowledge, that healthcare context specific knowledge,
1553240	1557880	and that doesn't exist, and you just have rapid turnover, you're risking someone forgetting about
1557880	1561400	the device or what you did about it. And as a consequence, you're just putting yourself
1561400	1564500	out there more and becoming even more vulnerable.
1566040	1571140	So I want to talk about communication a little bit, because I think that this is something that
1571140	1577060	has been very challenging from a clinical standpoint, right? And so tell me if you have
1577060	1583520	had the experience where you are caring for these patients, you are constantly receiving
1583520	1588120	updated protocols with respect to how to safely use protective equipment or the certain situations
1588120	1592360	in which, you know, an aerosol generating procedure might be taking place. So you need
1592360	1596320	to have an N95 at that point. But if you're just going into, you know, assess the patient,
1596320	1600880	you can get away with contact droplet precautions. There's so much that we are learning in real
1600880	1608200	time about the sort of natural course of this disease, about best practices for how to treat
1608200	1615940	it. That communication from a clinical standpoint is very important. And there's a transparency
1615940	1620920	that I think, with the best examples of this, it's very beneficial to kind of tell people,
1620920	1623760	this is the information that we're seeing, this is how we're making these decisions,
1623760	1627320	this is why we're implementing things in a certain way. And when you have situations
1627320	1633160	where that's not the case, you know, whether it's canceling elective surgeries, whether it's
1633160	1637180	how we allocate beds, whether it's our testing protocols and things like that, it's very
1637180	1642800	demoralizing and kind of dispiriting sometimes for the clinicians across the country to be put
1642800	1645800	in situations where they don't really understand how the decisions are made or how they're
1645800	1652920	communicated. There is an entire other filter over that with respect to certain, you know,
1652920	1657160	trustworthiness of information from a partisan or ideological standpoint that we need to get
1657160	1664020	into. But clearly, communication and how we talk to each other during these types of situations
1664020	1669000	has been key on the clinical side. And I was just wondering what your thoughts were
1669000	1673900	with respect to how we talk about healthcare security and those issues.
1674860	1685520	Yeah, I remember when we first started seeing COVID patients at my hospitals. And I remember
1686380	1692300	many doctors across the country were getting their information about how to treat them on Twitter.
1692640	1699880	You know, should you give large amounts of IV fluid? Should you give patients ibuprofen if
1699880	1704680	they have... remember that? There was this issue about whether or not NSAIDs like ibuprofen could
1704680	1710340	make it worse. There was... I remember this adamantly. The first time I had to intubate
1710880	1717620	a COVID patient, it was because there was this very early information saying,
1717620	1723260	hey, you should intubate these patients early instead of try non-invasive airway maneuvers like
1723260	1729700	high flow oxygen or BiPAP. There was this fear around BiPAP that if you put this on, it's a mask,
1729700	1733960	it goes over their mask and provides positive pressure and helps patients breathe.
1733960	1738180	The fear was that that would aerosolize the virus and that everyone in the room,
1738180	1742940	even if you were covered head to toe in PPE, would get the virus if you put a patient on BiPAP. So
1742940	1748360	there's all these different communication streams, getting information on how to treat patients on
1748360	1753760	Twitter, the academic literature, which is the foundation of how we treat patients, right? So
1753760	1760720	in medicine, we do studies, we design things, and we collect data, we publish on the scientific
1760720	1767480	method. In COVID, a lot of that we didn't have time for, like we didn't have random placebo
1767480	1774020	controlled trials on ibuprofen yet. We didn't have this type of information. So these communication
1774020	1780360	streams, they just weren't authoritarian. They weren't coming in a coherent way. There was
1780360	1786920	conflicting information. There was a lot of concern about where the data was coming from,
1786920	1793300	you know, and as a consequence, I think it really just paralyzed a lot of frontline
1793880	1799160	clinicians. We were, what do we do? I heard we should do this yesterday. Now I'm hearing we
1799160	1807760	shouldn't do it today. That was really unfortunate. Its parallels in healthcare cybersecurity are many.
1807760	1812240	We've already touched on a few, you know, information sharing being one of them, but I just
1812240	1819040	want to bring up a very important part of this, which is, if there is any silver lining out of
1819040	1825600	what, you know, of the response to coronavirus, it's that the academic journals that a study could
1825600	1832500	take years to collect data and publish, big journals like the New England Journal, Lancet,
1833100	1839500	a few, JAMA, etc. They said, we need to rapidly review this literature and start getting it out
1839500	1844520	there. So they reduced their standards for what would get published a little bit for the sake of,
1844520	1849840	we need to rapidly publish. At the heart of that is this need for information sharing
1849840	1856740	and communication. It wasn't the best, but at least they tried. We don't have that in healthcare
1856740	1865020	cybersecurity. We don't have hospitals knowingly giving us information, data, anonymized data
1865020	1872740	on attacks. We don't share data and study it critically and publish that very often. Instead,
1872740	1876920	hospitals are saying, we got breached. We don't need to study this. We don't need to share the
1876920	1881180	raw data. Instead, we need to forget that this happened, pay our HIPAA fine, and hope we don't
1881180	1887100	ever get into scrutiny again. We really need to change our philosophy in healthcare security
1887100	1896060	to collect data, pool data, design studies where we can make some meaningful conclusions at the
1896060	1901160	end of the day. That's science. We need to share that with everyone. We need to go through peer
1901160	1906360	review so that other people can review the data and make sure that what we're saying is consistent
1906360	1910700	with what they've experienced. So at the end of the day, we can answer some fundamental questions
1911220	1916840	that people on this video call have heard time and time again. For example, the question,
1916840	1921680	should you pay the ransom if your hospital is ransomed? You'll hear 15 different opinions
1921680	1926360	about whether or not you should pay the ransom if your hospital is under ransomware attack.
1926660	1933020	But what we don't have is a reliable data set from all the prior hospitals who've been ransomed,
1933020	1937600	looking at things like outcome, how much they paid so that we can take that data,
1937600	1944180	make meaningful conclusions, and through the scientific method, provide recommendations at
1944180	1949100	the end of the day that are evidence-based. In medicine, we call that evidence-based medicine.
1949100	1953320	We want to pick the right treatments and do the right thing because there's evidence.
1953320	1958440	In healthcare cybersecurity, we don't have the evidence base because we don't share it.
1958440	1965480	We really need to change that. COVID, we were able to, not perfectly, but we saw some glimmering
1965480	1970180	hopefully in some respects, particularly with the journals, of that getting better.
1970980	1977800	Yeah, I totally agree. I want to just go back and clarify too that when talking about the mixed
1977800	1983100	messages that we had early on, that in and of itself is not a problem. It's okay if we don't
1983100	1987980	know initially in a situation like this, whether the best clinical intervention is invasive
1987980	1992900	mechanical ventilation or non-invasive positive pressure ventilation. It's okay in the initial
1992900	1998140	period of this when we're still collecting those data points to be able to say, we don't know,
1998140	2002420	there are a couple of different possibilities here and we're going to try one or the other.
2002480	2005700	I mean, that's the scientific method. That's the process by which we generate a hypothesis
2005700	2011740	and then test it. So having different options or different messages initially is not an issue.
2011740	2017280	It's then needing to, as you said, gather that data. And I think we, even before all of this,
2017280	2022760	we have been of the perspective that if it does turn out that we are able to look back in five
2022760	2028200	to ten years, that healthcare security was not necessarily the issue of magnitude we thought it
2028200	2033020	was. I think you and I, as scientists, are both going to be fine with that and able to say, you
2033020	2040420	know, we're much more at peace with the concept of advocating for these issues and for it not
2040420	2044640	turning out to be a big patient safety issue than if we were to sort of ignore them and allow it
2044640	2051500	to be that. As kind of a tangent to that, I just wanted to ask you briefly, because from a standpoint
2051500	2056240	of communication in this space, in the healthcare security space, we often get opposing viewpoints,
2056240	2062800	which is totally fine. But something I've been thinking about is we have come into
2064260	2068400	conversations with people who have said, you know, healthcare is something that we don't think
2068400	2074800	attackers are particularly motivated to sort of target or focus on, because, you know,
2074800	2078200	it's a hospital and why would you go after a hospital or why would you go after a medical
2078200	2082240	device? We just don't think that's going to be a powerful motivating factor for people.
2082600	2087500	We've obviously seen some examples over the last couple of months where there have been attacks
2088060	2094360	at institutions that were actively treating COVID patients or actively engaged in COVID research.
2094560	2099280	And it seems that in some of those cases, the particular, you know, there was a very precise
2099280	2106220	targeting based on that fact and that situation. What do you think about the argument now that
2106220	2110260	healthcare is sort of this different sacrosanct space that won't necessarily be
2110260	2115840	the focus of other types of attacks because of its kind of unique nature in that sense?
2116560	2120480	Yeah, I think that's demonstrably false. You brought up a couple of good examples of
2121680	2129380	adversaries who willfully have targeted healthcare infrastructure, primarily COVID research,
2129380	2137420	for their own gain. And I think those out there that are still saying, you know,
2137420	2141060	hackers aren't going to target healthcare because no one would ever be that evil,
2141060	2146840	really just need to wake up to the fact that two things are true. One, adversaries are doing that.
2146960	2152600	Attacks are increasing, they're not decreasing. And then two, many adversaries might not even
2152600	2161000	know that they're attacking healthcare, right? So there's no set of IP addresses that are only
2161000	2166640	allocated to hospitals, right? So if you're out there scanning, trying to propagate malware,
2166640	2170380	you could hit a hospital and not even know it, right? And by the time you figure that out,
2170380	2177720	the damage might already be done. So I think we really need to go away from this paradigm of,
2178270	2186000	based on what we think attackers' motivations are, clearly to understanding their motivations,
2186000	2191940	but also assuming that we might not fully understand their motivations, or their motivations
2191940	2198560	may be ill-aimed, or that they might not even be intending to harm us. That's the way we stay safe.
2198560	2202620	You know, it's not bury our head in the sand, no one's evil enough to attack healthcare.
2202620	2207800	It's instead, assume it's being attacked every day because it is, and treat it like any other
2207800	2212880	valuable resource that a hacker, you know, a malicious adversary might be going after,
2212880	2218900	like a bank, for example. And these types of... and then also the research infrastructure is
2218900	2222720	really important. You know, people don't necessarily equate the scientific method
2222720	2228880	and institutions of higher learning as part of the healthcare infrastructure, but they truly are.
2228880	2235340	Many universities in this world are connected directly to hospitals, like their networks are
2235340	2241260	actually connected, right? So, in addition, the work that is done on the university side,
2241260	2246540	or the biotech side, directly influences clinical practice. And if you take out, for instance,
2246720	2255700	a COVID vaccine data cohort, right? So, we are testing the vaccine for the COVID rollout. If you
2255700	2261420	attack the infrastructure that collects the data about those results, you could put the vaccine
2261420	2269820	back weeks to months. And as a consequence, patients will die. That is a scary proposition.
2269820	2275600	And we got to understand that it's not very clear where the boundaries of healthcare stop.
2275600	2282400	And so, we really need a wider appreciation of what exactly is healthcare infrastructure
2282940	2288400	and what domains are affecting the care of patients that are much broader than most people realize.
2290740	2292880	Buddy, I want to talk really quickly about
2295380	2299480	some of the definitive solutions that we're searching for with respect to COVID. And I
2299480	2306660	think you mentioned that, you know, there are vaccines that are in the works. And I think,
2306660	2310420	hopefully, people will be able to look back after all this is over with it and say, man,
2310420	2315240	we really went through that process faster than any other time in human history. So,
2315240	2319640	to talk about a vaccine, you know, I think they're already in stage three trials. It's in the
2319640	2324740	candidate six months after this virus was first discovered. It's pretty incredible just from a
2324740	2329080	science standpoint. But right now, you and I clinically, when we're taking care of these
2329080	2335060	patients, we don't have direct therapeutics that are really targeted at how this particular virus
2335060	2339660	works and the way that it infects and spreads. We have adjuncts. We have things that we think
2339660	2345500	are helpful. And a lot of the care just kind of comes down to supportive practices with respect
2345500	2350040	to managing organ system effects and things like that, so that, hopefully, patients recover on
2350040	2356840	their own. So, we're still looking for therapeutics that work directly in inhibiting the virus
2356840	2361200	mechanism of action and replication. We're still looking for vaccines, obviously, to be rolled out.
2362740	2368700	I feel like there is a association there with how we think about some of the tools we have in
2368700	2373900	security writ large and how those are implemented in healthcare and how we really haven't yet
2373900	2379780	come to a place where we have healthcare-specific security tools or practices. This is obviously much
2379780	2385840	more relevant to medical devices and things like that, but where do you think we are
2385840	2391120	with respect to getting products and tools and practices that are tailored specifically for
2391120	2398460	healthcare? Yeah, I think we're on our way. We take this slide image because when we first started
2398460	2403920	into this and talking about this, shoot, Jeff, what it was like 10 years ago, 15 years ago?
2404400	2409840	I just looked back on my timeline and we started med school 10 years ago. Congratulations, you old
2409840	2416440	dude. When we first started getting into this, the only solutions that people would say to
2416440	2421700	protect a hospital were basically just rebranded security tools from other industries, right? So,
2421700	2427360	they basically just took, let's take the tenets and principles around PCI compliance and let's
2427360	2434420	make your hospital PCI compliant for healthcare medical devices. And what we really saw was that
2434420	2441900	just doesn't work. To draw an analogy from the medicine realm, we're not treating COVID by giving
2441900	2450340	flu shots, right? There are no antibiotics that work for COVID, right? So, just because they work
2450340	2454900	in other diseases doesn't mean they're going to work in this particular instance. And what
2454900	2461340	we've been saying for a long time is that if you just borrow the tools from other industries
2461340	2466760	without understanding how healthcare works and you deploy them in such a way, they're probably not
2466760	2472660	going to be very effective, right? We have a big problem with legacy devices in healthcare, for
2472660	2480320	example, that wouldn't be tolerated, legacy medical devices that run out-of-date operating systems
2480320	2484460	that are essentially unpatchable, that have really nasty vulnerabilities and that will be around on
2484460	2489760	your network for 10 years, for example. That wouldn't be tolerated in banking infrastructure
2489760	2494800	at a large bank, in a large, well-resourced bank, right? They wouldn't let a machine on their
2494800	2502700	network that had those vulnerabilities. But yet, we expect that if we take the same exact approach
2502700	2506920	to banking security and apply it towards healthcare cybersecurity, that we're going to get the same
2506920	2511400	results. And what you quickly realize is that that's just not possible. You have to really
2511400	2516400	change your way and understand the context around clinical care, for example.
2516400	2522420	You also have to understand how your cybersecurity tools impact clinical care,
2522420	2529300	right? So, just as much as there's been examples of vulnerable imaging devices like CT scanners
2529300	2535580	and MRI machines that can be infected with malware and cause availability issues, there's also been
2535580	2541860	discussions about examples of patching these devices, so well-intentioned patching
2541860	2548720	that results in essentially bricked devices. And if you don't have a CT scanner at a stroke
2548720	2554160	center, for example, or if you had two and you take one out because it's been bricked by a failed
2554160	2559980	patch, the next stroke patient or the next trauma patient that comes in to the hospital could have
2559980	2565720	to wait longer for their scan. And that could mean the difference about whether they get a
2565720	2570100	medicine in a critical time window. It could be the difference about whether they talk or they
2570100	2574700	walk. It could be the difference between whether or not they go to surgery and get a bullet taken
2574700	2580700	out of a particular location sooner. So, these have real implications. If you just think you
2580700	2586140	can apply your same philosophy, your same tools, in exactly the same way in healthcare, you're
2586140	2592440	going to be sorely mistaken. And you have to do so in a mindful way to avoid patient care
2592440	2599060	implications and patient harm. I could not agree more, my friend. Listen, we could probably talk
2599060	2602960	about this for another three hours. I think we have just barely scratched the surface here,
2602960	2606780	but I think we're almost at the 45-minute mark. And what I want to do is leave some time for
2606780	2611020	questions on the live session to make sure that we don't overstay our welcome.
2612360	2616820	This has been really fun. I am so happy we got to do this. I want to thank, again,
2616820	2619940	everybody at the Biohacking Village for giving us the opportunity. It's an honor.
2620100	2626280	We wish we could see you guys and give you big aseptic hugs, but unfortunately, that's not the
2626280	2632000	world that we're living in. We just hope everybody is staying safe and healthy. And hopefully this
2632000	2637500	time next year, we'll all get together and have a have a beer and be able to have this behind us.
2637500	2644300	Kwadi, I miss you, man. We should hang out sometime, virtually, of course. And
2644300	2648460	looking forward to the Q&A. And thanks, everybody. Appreciate it.